DORA RTS and ITS: Complete Technical Standards List

DORA is supported by 11 technical-standard mandates: nine Regulatory Technical Standards (RTS) and two Implementing Technical Standards (ITS). As of 25 August 2026, those mandates are reflected in 10 adopted Commission regulations. The numbers differ because the RTS required by DORA Articles 15 and 16 were adopted together in Commission Delegated Regulation (EU) 2024/1774.

These Level 2 rules turn parts of Regulation (EU) 2022/2554 into more precise requirements. They cover areas such as ICT risk management, incident classification and reporting, the Register of Information, third-party arrangements, threat-led penetration testing, subcontracting, and the oversight of critical ICT third-party providers.

If you only need the regulation-level picture, start with our What Is DORA? guide. This page has a narrower job: identify the technical standard, show the DORA article behind it, and point you to the official EU act that contains the binding detail.

What is the difference between a DORA RTS and ITS?

An RTS specifies how a requirement in DORA should be applied in more detail. The European Supervisory Authorities develop the draft technical standard under a mandate in DORA, and the European Commission adopts the final text through a delegated regulation.

An ITS standardizes how a requirement is implemented in practice, usually where common forms, templates, formats, or procedures are needed. Under DORA, the two ITS mandates cover the Register of Information templates and major incident reporting forms and procedures.

The practical distinction is less important than the legal status of the final act. Once the Commission regulation is adopted, published in the Official Journal, and in force, the technical detail is part of the binding DORA rule set. An old ESA consultation paper or draft final report is useful background, but it is not the document a compliance team should treat as the final legal text.

How many DORA RTS and ITS are there?

DORA gave the ESAs nine RTS mandates and two ITS mandates. They do not map one-for-one to 11 Commission regulations because the Article 15 ICT risk-management RTS and the Article 16 simplified ICT risk-management RTS were combined in one delegated regulation.

The adopted acts can therefore be counted in two valid ways. The first count is by DORA mandate: nine RTS plus two ITS. The second is by the final Commission act: eight delegated regulations containing RTS plus two implementing regulations containing ITS.

For day-to-day work, the Commission-act view is usually easier because that is what you open on EUR-Lex. The complete list is below.

ESMA keeps the current DORA Level 2 list on its DORA policy-requirements page. For the authentic legal text, use the Official Journal version linked through EUR-Lex.

How do the DORA technical standards fit together?

The standards are easier to use when they are read as one regulatory chain rather than as ten unrelated EU regulations. DORA sets the obligation at Level 1. An RTS can define the criteria, control detail, or timing behind that obligation. An ITS can then standardize the data or submission method used to carry it out.

Incident reporting is the clearest example. DORA Article 19 creates the reporting duty. The Article 18 RTS in Regulation 2024/1772 determines when an incident is major. Regulation 2025/301 specifies what the initial, intermediate, and final reports contain and when they are due. The ITS in Regulation 2025/302 provides the common reporting forms and procedures. A team that reads only one of those acts has only part of the operating requirement.

Third-party risk works in a similar way. DORA Articles 28-30 establish the financial entity's responsibility for ICT third-party risk. Regulation 2024/1773 adds detail for the policy governing services that support critical or important functions. Regulation 2024/2956 standardizes the Register of Information. Regulation 2025/532 adds the subcontracting assessment detail. Together they connect governance, contracts, dependency data, and material subcontracting risk.

This is also why the master DORA regulation should remain the starting point for legal scope while the technical-standard list remains the navigation layer. The Level 1 article tells you why a rule exists and who it addresses. The Level 2 act tells you what additional detail must be applied.

If you need the regulation-level view before working through the Level 2 acts, start with our What Is DORA? guide.

Why are older DORA RTS lists often incomplete?

A large amount of DORA content was published while the ESA drafts were still moving through consultation, Commission review, rejection, amendment, and final adoption. That history matters because an article written from a 2023 or mid-2024 consultation package can now point to a draft that is no longer the operative text.

The Register of Information is a good example. The ESAs submitted draft ITS, the Commission rejected the initial version, and the final standard was adopted as Implementing Regulation (EU) 2024/2956. The subcontracting RTS also went through further Commission review before the final act appeared as Delegated Regulation (EU) 2025/532 in July 2025. A current compliance register should therefore identify the adopted Commission act, not just the old ESA final-report reference number.

The same rule applies after adoption. EUR-Lex may publish corrigenda or consolidated versions. For example, the EUR-Lex record for Regulation 2024/1774 includes a 2025 corrigendum. When a control owner needs exact wording, the current EUR-Lex version should take priority over a downloaded copy saved during implementation planning.

Which DORA RTS cover ICT risk management?

Commission Delegated Regulation (EU) 2024/1774 is the main technical standard for the ICT risk-management framework. It combines the mandates in Articles 15 and 16(3), which is why one Commission regulation represents two RTS in the mandate count.

For entities subject to the full framework, it adds detail around ICT security policies, access control, asset management, encryption, operations security, network security, project and change management, physical and environmental security, HR-related ICT security, incident detection, continuity, response, and recovery. The same act also contains the simplified framework for the financial entities that DORA places under Article 16.

The official act is Commission Delegated Regulation (EU) 2024/1774. For the broader operating model behind these controls, use our Operational Resilience: What It Means Under DORA guide rather than treating the RTS as a standalone checklist.

Which technical standards govern DORA incident reporting?

Three adopted technical-standard acts sit behind the DORA incident workflow. Regulation 2024/1772 determines when an ICT-related incident is classified as major. Regulation 2025/301 sets the content and timing for the reports. Regulation 2025/302 provides the standard forms, templates, and procedures used to submit them.

Those acts answer different questions, so combining them into one vague "incident RTS" can create mistakes. Classification comes first. Reporting clocks and report content come next. The ITS then governs the standardized submission package.

For the operational sequence and current reporting clocks, see our DORA Incident Reporting Timeline and Workflow guide. The classification RTS itself is available as Delegated Regulation (EU) 2024/1772.

Which DORA standards cover third-party risk and the Register of Information?

Three technical-standard acts are especially important for ICT third-party governance. Regulation 2024/1773 specifies the policy for contractual arrangements supporting critical or important functions. Implementing Regulation 2024/2956 sets the standard Register of Information templates. Regulation 2025/532 adds the detailed subcontracting assessment requirements for ICT services supporting critical or important functions.

They should not be treated as three versions of the same vendor-control requirement. The policy RTS governs the contractual lifecycle. The ITS governs structured register data. The subcontracting RTS addresses the risk created when a provider relies on additional ICT subcontractors in a material service chain.

For implementation detail, use the DORA ICT Third-Party Risk Management guide and the DORA Register of Information Readiness guide. Those pages own the operating process; this page owns the technical-standard map.

What does the DORA TLPT RTS cover?

Commission Delegated Regulation (EU) 2025/1190 is the technical standard for threat-led penetration testing. It specifies which financial entities may be identified for TLPT and adds rules for internal testers, scope, testing methodology, the testing phases, results, closure, remediation, supervisory cooperation, and mutual recognition.

The standard matters directly to the financial entities selected for TLPT. Other organizations may still perform resilience testing under DORA without being subject to the same advanced-testing requirement.

The official text is Commission Delegated Regulation (EU) 2025/1190.

Which DORA RTS are mainly about critical ICT provider oversight?

Two technical-standard acts are primarily about how the EU oversight framework operates rather than about the ordinary control program inside every financial entity. Regulation 2025/295 sets conditions for oversight activities. Regulation 2025/420 covers the composition and working arrangements of joint examination teams.

These standards matter most to the ESAs, competent authorities, Lead Overseers, and ICT providers designated as critical at the Union level. A financial entity still needs to understand the oversight model, but it should not mistake JET staffing rules for a control requirement it must implement internally.

Which DORA Level 2 rules are not RTS or ITS?

A complete DORA reference needs one more distinction. Several important Level 2 measures sit beside the RTS and ITS but should not be added to the technical-standard count.

The most visible examples are Commission Delegated Regulation (EU) 2024/1502, which sets criteria for designating critical ICT third-party service providers, and Commission Delegated Regulation (EU) 2024/1505, which covers oversight fees. Their official titles do not identify them as regulatory technical standards.

The ESA package also includes guidelines, including guidance on estimating aggregated annual costs and losses caused by major ICT-related incidents and guidelines on oversight cooperation. Guidelines matter for supervisory practice, but they are not RTS or ITS.

This distinction is useful when teams build a DORA legal register. A column labeled "DORA technical standards" should not silently mix binding RTS/ITS, other delegated acts, guidelines, Q&As, and old consultation drafts as if they were the same type of instrument.

Which DORA technical standards should a financial entity read first?

The answer depends on the organization, but most financial entities can prioritize the standards by the work they actually perform. The core ICT risk-management RTS is usually the broadest operating reference. Incident standards matter to every entity that needs a defensible classification and reporting process. Register and third-party standards matter where external ICT services support operations. The TLPT RTS becomes central for entities selected for advanced testing.

The oversight RTS are different. They are important for understanding the critical-provider regime, but they are not the first place most financial entities should start when building their own DORA control program.

A practical reading order looks like this:

How should teams maintain a DORA standards register?

Do not copy a one-time list into a spreadsheet and assume the job is finished. Keep the DORA Article mandate, instrument type, Commission regulation number, publication link, internal owner, affected process, and any related policy or evidence location together. That makes the register useful for change tracking instead of turning it into a list of legal citations nobody opens.

It also helps prevent a common compliance problem: updating a policy because DORA changed while missing the technical act that contains the actual field, threshold, template, or process detail. The Level 1 regulation tells you where the mandate comes from. The RTS or ITS often tells the operating team what the detailed implementation must look like.

Final thoughts: Use the standards list as a map, not as the compliance program

A DORA technical-standard list is useful when it helps a team get from a DORA article to the exact legal detail that governs its process. The next step is to connect each relevant act to an owner, policy, workflow, data set, and evidence source inside the organization. That is where a legal inventory becomes operational work.

Frequently asked questions

How many DORA RTS are there?

DORA contains nine RTS mandates. They are reflected in eight adopted Commission delegated regulations because the Article 15 and Article 16 RTS were combined in Regulation 2024/1774.

How many DORA ITS are there?

There are two ITS mandates: one for the Register of Information templates and one for major ICT-related incident reporting forms, templates, and procedures.

Are DORA RTS and ITS legally binding?

Yes, once adopted by the European Commission and in force as EU regulations. ESA consultation drafts and final draft technical standards are not the final legal acts.

What is the difference between RTS and ITS under DORA?

RTS specify detailed regulatory requirements. ITS standardize practical implementation such as common templates, forms, formats, or procedures.

Where can I find the official DORA RTS and ITS?

Use the ESMA DORA policy-requirements page for the current map, then open the relevant regulation in EUR-Lex for the official legal text.

Is the DORA Register of Information an RTS or ITS?

The standard templates are an ITS, adopted as Commission Implementing Regulation (EU) 2024/2956 under DORA Article 28(9).

Is Commission Delegated Regulation 2024/1502 a DORA RTS?

No. It is an important DORA delegated act on critical ICT provider designation criteria, but its official title does not classify it as an RTS.

Do all financial entities need to implement every DORA RTS in the same way?

No. Applicability depends on the DORA provision, entity type, proportionality, critical functions, TLPT selection, and whether a rule concerns financial entities or the critical-provider oversight framework.